Google Security Research Apple Webkit - Universal Cross-Site Scripting by Accessing a Named Property from an Unloaded Window
webapps multiple CVE-2017-2367